A city hardens router management access so remote administrators must use SSH on the VTY lines, with authentication against locally configured usernames if the AAA servers are unreachable. Which approach best matches that intent?

The city hardens router management access so remote administrators must use SSH on the VTY lines, with authentication against locally configured usernames if the AAA servers are unreachable. The matching approach is to restrict VTY transport to SSH and use local username authentication with an appropriate AAA fallback method list: transport input ssh (or equivalent) blocks Telnet, and an authentication list that prefers central AAA then falls back to local keeps administrators able to manage devices during AAA outages without opening anonymous or cleartext remote access.

Allowing Telnet only and disabling all local usernames to force anonymous access fails by concept—it weakens confidentiality and removes the local fallback the stem requires. Binding every VTY to a SPAN destination and relying on packet captures for authentication confuses monitoring with access control; captures do not authenticate users. Replacing line authentication with IP SLA jitter responders as the login database invents a nonsensical identity store.

Exam caveat: harden VTYs with SSH-only transport, AAA method lists, and deliberate local fallback; distinguish authentication from authorization and accounting. Local usernames must exist and be privileged appropriately if fallback is expected to work.

Operational check for city routers: verify transport input excludes Telnet, test SSH login against AAA, simulate AAA unreachability and confirm local username login still works, and ensure enable/secret and privilege policies still protect configuration access.